OpenSslVerifyTruthyResult

warning native on by default quick-fix

Group: Security

OpenSSL signature verification returns 1 for success, while an error result can also be truthy. Accept only the explicit success result.

Example

Before

<?php
if(openssl_verify($s,$sig,$key,OPENSSL_ALGO_SHA256)){echo "accepted";}

After fix

<?php
if(openssl_verify($s,$sig,$key,OPENSSL_ALGO_SHA256) === 1){echo "accepted";}

Reported:

• line 2: Accept only verification result 1.

Detection

• Resolved openssl_verify is directly used as a truthiness condition or direct logical negation. Success is integer 1, while error -1 is truthy. Highlight call. The condition positions are those of if, elseif (and else if), while and do … while. Redundant parentheses are transparent at every level: around the call, between ! and the call, and around the negation.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

F1. Replace direct truthiness condition with (originalCall === 1); preserve all original argument bytes and evaluation count. For direct negation replace the whole ! expression, including any parentheses between ! and the call, with originalCall !== 1; parentheses outside the replaced expression are kept. Do not rewrite a stored result assignment or a general value-producing use. Preserve parentheses and comments surrounding the call; if the chosen replacement span would discard comments, suppress the fix.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "OpenSslVerifyTruthyResult": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore OpenSslVerifyTruthyResult